Google PCA Practice Test 48 — 15 Questions

Question 1

An online retailer runs a stateless containerized API on Google Kubernetes Engine. Traffic is highly seasonal, spiking sharply during flash sales and dropping to near zero overnight. The operations team wants the cluster to add and remove nodes automatically based on pod demand while keeping costs low during idle periods. What should the architect recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable cluster autoscaler on the node pools and configure a HorizontalPodAutoscaler on the API deployment.. Cluster autoscaler and HorizontalPodAutoscaler are complementary controls: the HPA adjusts replica count based on demand signals, and the cluster autoscaler provisions or removes nodes to match the resulting scheduling pressure. This combination gives the retailer elasticity during flash sales and near-zero node cost overnight without manual intervention.

Answer

Deploy the API on Cloud Run and remove the GKE cluster entirely, relying on request-based scaling.

Answer

Configure a regional managed instance group with a fixed size and enable autoscaling on the deployment only.

Answer

Set the node pool to a large fixed size sized for peak flash-sale traffic and rely on the scheduler to pack pods efficiently.

Question 2

A startup is deploying a new web application on Google Cloud. The application runs in containers on Google Kubernetes Engine (GKE) and uses a Cloud SQL for MySQL instance. The team wants to follow the principle of least privilege for the application's access to Cloud SQL. Which method should the architect recommend for authenticating the application to Cloud SQL?

Accepted Answer

Use Cloud SQL IAM database authentication with a dedicated service account for the application.. Cloud SQL IAM database authentication lets the application authenticate with a service account, removing static passwords and enabling fine-grained IAM roles. This follows least privilege by granting only the necessary database permissions to a dedicated service account. Storing passwords in Kubernetes Secrets, using the default compute service account, or relying on network controls do not provide identity-based least-privilege access.

Answer

Configure a Cloud VPN tunnel between the GKE cluster and Cloud SQL, and use IP allowlisting.

Answer

Create a MySQL user with a strong password and store the password in a Kubernetes Secret.

Answer

Enable the Cloud SQL Admin API and use the default compute service account for authentication.

Question 3

A financial services firm is designing a new payment processing system on Google Cloud. The system must expose a single global anycast IP address, terminate TLS at the edge, and route requests to the nearest healthy backend across three regions. The backend services run on Compute Engine and must be protected from volumetric DDoS attacks. Which product should you place in front of the backends?

Accepted Answer

Global external Application Load Balancer with Cloud Armor security policies attached to the backend service.. A global external Application Load Balancer delivers a single global anycast IP, terminates TLS at Google's edge, and uses health-checked backends to route to the nearest region. Cloud Armor security policies attach to the backend service and provide DDoS and web application firewall protection. Regional load balancers cannot offer one global IP, and Layer 4 proxy or passthrough load balancers do not terminate HTTP(S) at the edge or support Cloud Armor in the required way.

Answer

Global external Proxy Network Load Balancer with Google Cloud Armor attached to the target proxy.

Answer

Regional external Application Load Balancer in each region with Cloud CDN enabled for caching.

Answer

External passthrough Network Load Balancer with a global forwarding rule and Cloud Armor on the backend.

Question 4

A startup is deploying a new web application on Google Kubernetes Engine (GKE). They want to expose the application to the internet with a single global IP address and automatically route users to the closest regional cluster. They also want to minimize operational overhead. Which GKE feature should they use?

Accepted Answer

GKE Ingress with a global external Application Load Balancer. GKE Ingress automatically provisions a global external Application Load Balancer, providing a single global IP and intelligent routing to the closest regional backends. It is fully integrated with GKE and requires minimal operational effort. The other options either provide regional load balancing or require manual configuration, which does not meet the requirement for minimal overhead and global reach.

Answer

GKE Gateway with a regional gateway class

Answer

GKE Network Endpoint Groups (NEGs) with a standalone global load balancer

Answer

GKE Service of type LoadBalancer with a regional external passthrough Network Load Balancer

Question 5

An online learning platform runs its API on a regional managed instance group behind an external Application Load Balancer. The operations team wants to release new versions with the ability to shift a small percentage of user traffic to the new version first, then increase it gradually, and roll back instantly if error rates rise. What should they implement?

Accepted Answer

Create a second managed instance group for the new version and use the load balancer's backend service with a small weight on the new group.. The Application Load Balancer supports multiple backends per backend service and can distribute traffic by weight or capacity, so registering a second managed instance group for the new version enables a canary. Adjusting weights shifts exposure gradually, and returning the new group's weight to zero restores the previous version immediately.

Answer

Configure Cloud CDN with a cache key that includes the application version header and purge the cache after each deployment.

Answer

Enable autoscaling on the existing managed instance group and set the target CPU utilization lower during the release window.

Answer

Use an internal passthrough Network Load Balancer in front of the managed instance group and switch the target pool during the release.

Question 6

A financial services firm runs a regulated workload on Compute Engine. Auditors require that all data at rest on persistent disks be encrypted with keys the firm controls and can revoke, and that key usage be logged independently of the project's Cloud Audit Logs. The firm's security policy forbids storing key material in the same project as the workload. Which approach meets these requirements?

Accepted Answer

Create a Cloud KMS key ring in a separate security project, grant the workload's service account `roles/cloudkms.cryptoKeyEncrypterDecrypter`, and attach a customer-managed encryption key to the disks.. Customer-managed encryption keys in Cloud KMS let the firm rotate and revoke key material, and hosting the key ring in a separate security project enforces separation of duties. Cloud KMS logs key operations in the key's own project, giving auditors independent visibility that is not tied to the workload project's audit configuration.

Answer

Encrypt the disks with customer-supplied encryption keys stored in a Cloud Storage bucket in the workload project.

Answer

Use Confidential VMs with encrypted persistent disks and rely on the hypervisor to manage disk keys.

Answer

Use Google-managed encryption keys and enable Data Access audit logs for Compute Engine in the workload project.

Question 7

A global logistics company runs a three-tier application on Compute Engine in a single region. The database tier must survive the loss of an entire zone without data loss, and the application tier must continue serving traffic with minimal disruption during a zonal failure. The architect wants the smallest operational change that satisfies both requirements. Which design should the architect implement?

Accepted Answer

Deploy the application tier in a regional managed instance group across three zones and move the database to a Cloud SQL for PostgreSQL instance with high availability enabled.. A regional managed instance group spreads application instances across zones and self-heals when a zone fails, while Cloud SQL high availability keeps a synchronized standby in another zone and fails over automatically without losing committed transactions. That pairing satisfies both continuity and durability with minimal change to the existing three-tier design.

Answer

Deploy the application tier in a zonal managed instance group and replicate the database to a read replica in a second zone using asynchronous replication.

Answer

Deploy the application tier in a regional managed instance group across three zones and keep the database on a single-zone Cloud SQL instance with daily automated backups.

Answer

Deploy the application tier in a zonal managed instance group and configure Cloud SQL with automated backups and point-in-time recovery enabled.

Question 8

Your company uses Cloud SQL for PostgreSQL to support a web application. During peak hours, the database experiences high read load, causing slow query responses. You need to improve read performance while ensuring data consistency. What should you do?

Accepted Answer

Create a read replica and configure the application to send read queries to the replica.. Creating a read replica allows read queries to be offloaded from the primary instance, directly addressing high read load and improving performance. It scales reads horizontally and is a standard pattern for read-heavy applications. Other options either do not distribute read traffic or provide only temporary vertical scaling.

Answer

Increase the machine type of the Cloud SQL instance to a larger size with more vCPUs and memory.

Answer

Enable high availability (HA) on the Cloud SQL instance to distribute read traffic across multiple zones.

Answer

Configure Cloud SQL to use SSD storage instead of HDD to improve read throughput.

Question 9

A media company is designing a new content delivery architecture on Google Cloud. Users worldwide download large video files, and the company wants to serve them from a global edge cache while keeping the origin bucket private. They also want to reduce egress cost by caching at the edge. Which Google Cloud service should you recommend as the front end for this architecture?

Accepted Answer

Cloud CDN with a global external Application Load Balancer and a Cloud Storage backend bucket.. Cloud CDN integrated with a global external Application Load Balancer and a Cloud Storage backend bucket delivers content from Google's global edge, cutting latency for worldwide users and reducing origin egress by serving cached responses. The bucket stays private because only the load balancer's service account is granted read access, so the architecture meets both the caching and privacy requirements.

Answer

A regional external Application Load Balancer in front of a Managed Instance Group that serves the video files from local SSD.

Answer

Cloud Storage with a multi-region bucket and signed URLs generated per user request.

Answer

Cloud Interconnect between the company's data center and a Google Cloud region, with the bucket served from that region.

Question 10

A startup is deploying a containerized application on Google Kubernetes Engine (GKE). The development team wants to minimize operational overhead for managing the Kubernetes control plane and nodes. They also want to ensure that nodes are automatically upgraded and repaired. Which GKE mode should they use?

Accepted Answer

GKE Autopilot mode with a regional cluster.. GKE Autopilot mode is designed to minimize operational overhead by fully managing the control plane and nodes, including automatic upgrades and repairs. A regional cluster provides high availability across multiple zones. Together, they meet the startup's requirements for reduced management and automatic node lifecycle operations.

Answer

GKE Standard mode with a regional cluster and node auto-repair enabled.

Answer

GKE Standard mode with a zonal cluster and manually managed node pools.

Answer

GKE Autopilot mode with a zonal cluster.

Question 11

A small startup is deploying a new application on Google Cloud. They want to ensure that they can monitor the application's performance and receive alerts when certain thresholds are exceeded. They have limited operational staff and want a managed solution that requires minimal configuration. Which Google Cloud service should they use?

Accepted Answer

Cloud Monitoring with alerting policies based on metrics and log-based alerts.. Cloud Monitoring is the managed service on Google Cloud for collecting metrics, creating dashboards, and setting up alerting policies. It integrates with many Google Cloud services and can send notifications via email, SMS, Slack, PagerDuty, and more. For a startup with limited staff, it requires minimal setup and no infrastructure management. Log-based alerts extend its capabilities to specific log events. This makes it the ideal choice for monitoring performance and receiving alerts.

Answer

Cloud Logging with log sinks to BigQuery and custom scripts to analyze logs.

Answer

Cloud Trace with custom instrumentation and manual analysis of trace data.

Answer

Cloud Profiler with continuous profiling and manual review of profiles.

Question 12

A healthcare company stores patient records in Cloud Storage and BigQuery. Auditors require that cryptographic keys used to protect this data are generated and stored on hardware security modules, that key material never leaves Google's infrastructure, and that the company retains the ability to control key rotation and revocation. The security team wants the least operational overhead while meeting these requirements. Which key management approach should the architect select?

Accepted Answer

Customer-managed encryption keys (CMEK) backed by Cloud KMS with a Cloud HSM protection level. Customer-managed encryption keys using Cloud KMS with the Cloud HSM protection level satisfy all three auditor conditions: hardware security module key generation and storage, key material confined to Google infrastructure, and customer control over rotation and revocation. CSEK and client-side encryption move key custody to the customer and add heavy operational cost, while Google-managed keys remove the customer control the auditors demanded.

Answer

Google-managed encryption keys with default encryption at rest

Answer

Customer-supplied encryption keys (CSEK) managed in the company's own on-premises key vault

Answer

Client-side encryption performed by the application before writing objects to Cloud Storage

Question 13

A media company runs a monthly batch pipeline that transcodes video uploads stored in Cloud Storage. The pipeline runs on a Managed Instance Group of Compute Engine VMs and typically completes in 6 hours. The VMs are only needed during this window, but the team wants to minimise the operational effort of stopping and starting the group. Which approach best optimises both cost and operational overhead?

Accepted Answer

Create an instance schedule that starts and stops the managed instance group on a recurring monthly calendar.. The workload has a known, recurring schedule, so the most efficient optimisation is to stop paying for VMs when the pipeline is not running. Instance schedules on a managed instance group start and stop instances automatically, which lowers compute cost and removes manual start/stop toil. Autoscaling, preemptible VMs, and Cloud Run do not eliminate the idle monthly window in the same controlled way.

Answer

Move the transcoding workload to a Cloud Run service with a minimum instance count of zero.

Answer

Convert the VMs to preemptible instances and configure a restart policy.

Answer

Enable autoscaling on the managed instance group based on CPU utilisation.

Question 14

A financial services firm runs a latency-sensitive trading API on Google Kubernetes Engine (GKE). During peak market hours, the API occasionally returns errors because pods are evicted when nodes run out of memory. The team wants the workload to be protected from node-level resource pressure and to receive a graceful termination window when the node must be drained. Which configuration should they apply to the Deployment?

Accepted Answer

Set memory requests equal to limits to achieve Guaranteed QoS, assign a high-priority class, and increase terminationGracePeriodSeconds to allow graceful shutdown.. Guaranteed QoS, achieved by setting memory and CPU requests equal to limits, makes pods the last to be evicted when a node is under memory pressure. Pairing that with a high-priority class and a longer terminationGracePeriodSeconds protects the trading API from involuntary eviction and gives it time to drain in-flight requests gracefully, matching both stated requirements.

Answer

Configure the pods with Guaranteed QoS by setting requests equal to limits, and set a high priorityClassName so they are evicted last.

Answer

Set a PodDisruptionBudget with minAvailable equal to the replica count and configure a longer terminationGracePeriodSeconds.

Answer

Define resource requests and limits for CPU and memory, and set the pod's priorityClassName to a high-priority class.

Question 15

A small e-commerce team wants to deploy a containerized storefront to Google Cloud with minimal operational overhead. Traffic is steady, the team has no Kubernetes expertise, and they want to pay only for what they use while the service scales automatically. Which compute option should the architect recommend?

Accepted Answer

Cloud Run services with request-based autoscaling and scale-to-zero enabled.. The deciding factors are the containerized workload, the lack of Kubernetes skills, and the desire for consumption-based pricing with automatic scaling. Cloud Run accepts a container image, manages all infrastructure, and scales instances up and down with request load, including down to zero when idle. That removes cluster operations entirely while still billing per use, which is exactly the profile the team described.

Answer

Compute Engine managed instance groups with an autoscaling policy based on CPU utilization.

Answer

Google Kubernetes Engine Autopilot cluster with a Horizontal Pod Autoscaler.

Answer

App Engine standard environment with automatic scaling and an instance class sized for peak traffic.